# Audit Notes — Key Areas for Review

## Priority 1: Cryptographic Integrity

### HMAC Protocol (CRY-02)
- **Canonical format**: `HMAC-SHA256(ts.nonce.METHOD.path.body)` — dots, not colons
- **13 bash tools** converted on 2026-07-04 — verify each tool's `_report()` or `_sign()` function
- **Headers**: `x-engine-ts`, `x-engine-nonce`, `x-engine-sig`, `x-engine-node`
- **Reference**: `01_DOCUMENTATION/ENGINE_STANDARDIZATION.md` §HMAC Protocol
- **Files to check**: All files in `03_TOOLING/*/raw/svc*`, `mesh_heartbeat.sh`, `mesh_report.sh`

### SCLS Encryption Pipeline
- **Encrypt**: AES-256-CBC with random IV, gzip before encrypt
- **Sign**: HMAC-SHA256 of base64-encoded ciphertext
- **Verify match**: `03_TOOLING/Engine_669427/raw/audit_logger.sh` (encrypt side) must match `02_ORIGIN_WEB/dashboard/security/DecryptionService.php` (decrypt side)
- **Key management**: Per-node keys, stored in `/opt/sysc/engine/vault/node_keys/`

## Priority 2: Network Isolation

### Firewall Rules
- **Every node**: Default zone MUST be `drop` (or UFW deny for DNS)
- **SSH 9922**: ONLY on WG interfaces, NEVER public
- **Cross-reference**: Each `03_TOOLING/*/raw/firewall_*.sh` against `01_DOCUMENTATION/PORT_STANDARDIZATION.md`
- **Stale ports**: Verify 33022, 30222, 49616 are NOT open anywhere

### WireGuard Tunnels
- **Reference**: `01_DOCUMENTATION/WIREGUARD_MAP.md`
- **PSK**: All tunnels except wg7 MUST have PresharedKey
- **forge tunnel**: NEW (172.28.50.0/28, port 45247) — verify configs match on hub + spokes
- **Pull required**: Run `pull_remote_configs.sh` to get live WG configs from nodes

## Priority 3: Authentication & Access Control

### SSH Security
- Two accounts: `admin` (gabriella key) and `administrator` (PPK keys)
- NEVER mix keys between accounts
- `PasswordAuthentication no` ALWAYS
- `PubkeyAuthentication yes` ALWAYS
- `PermitRootLogin no` ALWAYS
- **Reference**: `01_DOCUMENTATION/rules.md` §SSH Access, `01_DOCUMENTATION/Need_To_Know.md`

### Dashboard Auth
- 3-phase auth: session → RBAC → HMAC
- `02_ORIGIN_WEB/dashboard/api/bootstrap.php` — auth chain
- `02_ORIGIN_WEB/dashboard/core/tabs.php` — RBAC per tab
- Audit tab requires `admin` role + `decrypt.pii` for decryption

## Priority 4: Database Security

### Engine DB (669427)
- MySQL bound to `127.0.0.1` ONLY — verify in `04_ENGINE_BUILD/deploy/669427.env`
- No direct remote MySQL — all through C++ API on 8301
- SCLS migration: `05_DATABASE/06-scls.sql`
- **Reference**: `01_DOCUMENTATION/DATABASE_STANDARDIZATION.md`

### Store DB (Origin)
- MySQL bound to `localhost` ONLY
- `tooling` user on `shared_engine` DB — SHOULD BE DECOMMISSIONED (see docs)

## Priority 5: Tool Execution Security

### Decrypt Pipeline
- All tools encrypted at rest (AES-256-CBC, PBKDF2 100k iterations)
- Decrypted to `/dev/shm` (RAM only), shredded after execution
- HMAC signature verified before decryption
- **Reference**: `01_DOCUMENTATION/TOOLING_STANDARDIZATION.md` §Decrypt-and-Execute Pipeline

### Self-Healing
- `s3rv1c3agent` (disguised as postfix-qmgr-aux on Engine) is the central orchestrator
- Each tool has self-healing capabilities
- `svcwatch` monitors file integrity, credential state, SSH config
- **Reference**: `01_DOCUMENTATION/TOOLING_STANDARDIZATION.md` §Tool Categories
